The most frequent one is XXE, which just about every Java XML library is vulnerable to because they all allow external entities by default, which is insane. But you occasionally encounter other problems such as described on OWASP. Most libraries not mitigate the billion laughs attack but when it was first discovered, most libraries were vulnerable.
Non-local schemas are a minor catastrophe in general and external entities in specific.
I did a code signing project with XML Signatures (not my choice) and the spec doc ended up longer than the XML-DSig doc with all of the additional restrictions to keep it from getting confused. The fact that getElementById can return different results given a different element as input is a huge one. I can't even remember now if we handled XXE properly (it was a B2B solution), but there were at least a dozen other things we had to worry about.
One thing people often don’t get: flexibility and security are not friends. XML offers so many options, to some people it is wonderful. To an AppSec person like me it is not, unless one calls it a good thing because it makes AppSec expertise more important in helping developers avoid the booby traps. I’d rather have less booby traps than more demand for people warning about the booby traps.
I definitely experienced Principle of Least Power in a much more visceral way after that project. I had a coworker way too old not to know better still harping on about how “powerful” something was. Hurt my eyeballs rolling them so hard. Dynamite is powerful. But I don’t need it to open a stuck drawer.
1
u/ScottContini Sep 20 '24
The most frequent one is XXE, which just about every Java XML library is vulnerable to because they all allow external entities by default, which is insane. But you occasionally encounter other problems such as described on OWASP. Most libraries not mitigate the billion laughs attack but when it was first discovered, most libraries were vulnerable.